Live › vulnerability › CVE-2026-114515
Go to dashboardOCO-Server, a self-hosted endpoint management application, lets a Self-Service Portal user with job-container permission queue uninstall jobs for packages they lack deploy rights to. The permission check in the uninstall path continues after denials and runs under a null system user, so removals can reach computers visible to the user's role.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running OCO-Server before 1.2.3 with the Self-Service Portal enabled, where portal users can create job containers and read computers and packages. Exposure depends on what roles those users hold; installations without Self-Service Portal users are not described as affected by the sources.
No product ranges from the sources yet.
1.2.3 (the sources say the fix is in 1.2.3, but no command for reading the version is given: unknown)1.2.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to self-service/ajax-handler/job-containers.php pass uninstall_package_assignment_id[] values to lib/SelfService/CoreLogic.class.php::uninstallSelfService(). Its permission-check loop continues after denied METHOD_DEPLOY checks without removing rejected IDs from $installationIds, then passes the original list to lib/CoreLogic.class.php::uninstall(). The CoreLogic object is constructed with a null SystemUser, causing lib/CoreLogic.class.php::checkPermission() to treat the operation as system context and unconditionally permit it. Enumerable computer_package.id values allow selection of readable installed-package assignments, including those on other users' computers. The deploySelfService() install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-114515")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.